Angriffe melden & weltweit blocken
Das Angriffsabwehr-Netzwerk ist ein Community-Netzwerk in beide Richtungen: Ihre Server melden Angriffe (SSH-Brute-Force, IMAP, Web-Angriffe - 109 Dienst-Typen) automatisch per fail2ban an eine zentrale Liste. Gleichzeitig blocken Sie gemeldete Angreifer automatisch auf Ihren eigenen Servern und Firewalls - in 2 Minuten eingerichtet.
Gäste-Modus: begrenzte Nutzung. Kostenlos registrieren für unbegrenzte Nutzung, Verlauf & Statistiken.
Kostenlos registrierenReport attacks.
Block them worldwide.
The Attack Defense Network is a network in both directions: report attacks from your servers via fail2ban, CrowdSec or API - and automatically block reported attackers via fail2ban. Free, no account, GDPR compliant.
Live Check
sample data possible1. Server reports
fail2ban bans an attacker and reports the IP to us automatically via HTTP API.
2. We score
One report reaches the watchlist, two independent reports list the IP - critical categories list immediately. Scoring, confidence and reporter reputation determine severity and expiry.
3. World blocks automatically
Other admins automatically receive reported attackers in their fail2ban block jail (synced every 5 minutes). The DNS zones are used to check individual IPs - and the responsible provider is notified anonymously.
Set up fail2ban (2 minutes)
One command, done: the installer script installs fail2ban if needed, backs up existing configs, sets up reporting AND automatic blocking of reported attackers and restarts the service. Use the "Report only" toggle to disable blocking. With a free account you additionally get report tokens.
curl -sS https://reports.provider.tools/api/v1/abuse/fail2ban-install | sudo bashYour server automatically blocks reported attackers.
API Reference
One endpoint for your server automation. Full documentation in the Knowledge Base.
POST https://reports.provider.tools/api/v1/abuse/report
Content-Type: application/json
{ "ip": "203.0.113.7", "service": "ssh", "port": 22 }
Service examples: ssh, imap, smtp-auth, http, mysql, wordpress, minecraft, ddos, sqli, malware, portscan - 100+ supportedWhen does an IP get listed?
A single report (with token or anonymous - every report counts equally) only reaches the watchlist. Two independent reports soft-list the IP (the check zone returns a block code), further reports hard-list it. Critical categories (malware, botnet) list with a single report. Entries expire automatically without new reports (7 days).
Read the scoring modelAnonymous & GDPR compliant
No reporter identity: reports are processed anonymously, no reporter IPs, no log contents.
Minimal evidence: publicly visible are only category, score, service and the hour of the signal.
Automatic decay: scores decay exponentially, entries disappear automatically without new activity.
Hosted in Germany, no transfer to third countries.
Frequently Asked Questions
When does an IP get listed?
A single report (with token or anonymous - every report counts equally) only reaches the watchlist. Two independent reports soft-list the IP (the check zone returns a block code), further reports hard-list it. Critical categories (malware, botnet) list with a single report. Entries expire automatically without new reports (7 days).
How are false positives avoided?
Five protection layers: listing requires two independent reports (a single report - with or without token - only reaches the watchlist), reporter reputation dampens unreliable sources, an internal whitelist protects your own infrastructure, dnswl.org whitelisting reduces weight for trusted mail servers, and tor exits are flagged instead of being reported to abuse desks.
What happens to tor exit nodes?
Tor exits are still scored (the attacks are real) but flagged with tor-exit in the evidence. Admins can allow or block them via firewall rules. Abuse notifications are not sent for tor exits.
Which DNS zones are available?
Each of the 109 services has its own check zone: <service>.attacks.provider.tools (e.g. ssh., imap., smtp-auth.), plus the base zone attacks.provider.tools for all. Automatic blocking uses the HTTP export - the text list is synced every 5 minutes.
Is the service really free?
Yes. Reporting, DNS queries and IP checks are free and work without an account. There are no hidden limits for basic operation.
So funktioniert es
1. Server meldet
fail2ban bannt einen Angreifer und meldet die IP automatisch per API.
2. Wir bewerten
Jeder Report ist ein Signal - Kategorie, Konfidenz und Reputation bestimmen den Score.
3. Alle blocken automatisch
Gemeldete Angreifer werden per Block-Jail (5-Minuten-Sync) weltweit gebannt.
Funktionen im Detail
fail2ban-Integration
Ein Befehl installiert Melden + automatisches Blocken in 2 Minuten.
109 Dienst-Typen
SSH, IMAP, SMTP, Web-Angriffe, Datenbanken, Spiele-Server u.v.m.
Weltweites Blocking
Angreifer werden überall geblockt, nicht nur dort, wo sie erwischt wurden.
Firewall-Integration
Fertige Scripts für iptables, nftables, ufw, pf und Windows Firewall.
Vorsichts-Prinzip
1 Report = Watchlist, ab 2 unabhängigen Reports gelistet - keine Willkür-Sperren.
Anonym & DSGVO
Keine Reporter-Identität, keine Log-Inhalte, Hosting in Deutschland.
Häufige Fragen
Wie installiere ich die Angriffsabwehr?
Mit einem Befehl: curl -sS https://reports.provider.tools/api/v1/abuse/fail2ban-install | sudo bash - installiert fail2ban, richtet das Melden und das automatische Blocken ein.
Wann wird eine IP gelistet?
Ein einzelner Report (mit oder ohne Token) erreicht nur die Watchlist. Ab zwei unabhängigen Reports wird gelistet, kritische Kategorien (Malware, Botnet) sofort. Einträge verfallen nach 7 Tagen ohne neue Meldungen.
Kann ich nur melden, ohne zu blocken?
Ja - mit dem Toggle "Nur melden" oder &block=0 im Install-Befehl.
Funktioniert es auch ohne fail2ban?
Ja - die Reporting-API ist offen für jedes System (CrowdSec, eigene Scripts), und fürs Blocken gibt es Firewall-Scripts für iptables, nftables, pf & Windows.
Was kostet die Angriffsabwehr?
Nichts. Melden, Blocken und IP-Checks sind kostenlos. Ein Gratis-Account schaltet lediglich Report-Tokens für persönliche Server-Statistiken frei.